rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix SOA permissions handling + add scope conditions

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-01-21 13:30:41 +04:00
parent ff65303a1a
commit 7ce73bbcfa
12 changed files with 272 additions and 201 deletions
Download Patch File Download Diff File Expand all files Collapse all files

114
pkg/coredata/state_of_applicability.go
View File

@@ -264,7 +264,8 @@ SET
name = @name,
owner_id = @owner_id,
updated_at = @updated_at
WHERE %s
WHERE
%s
AND id = @state_of_applicability_id
`
@@ -303,7 +304,8 @@ func (s *StateOfApplicability) Delete(
) error {
q := `
DELETE FROM states_of_applicability
WHERE %s
WHERE
%s
AND id = @state_of_applicability_id
`
q = fmt.Sprintf(q, scope.SQLFragment())
@@ -346,31 +348,32 @@ func (soas StatesOfApplicability) insertStateOfApplicabilitySnapshots(
) error {
query := `
INSERT INTO states_of_applicability (
id,
tenant_id,
organization_id,
name,
source_id,
snapshot_id,
owner_id,
created_at,
updated_at
id,
tenant_id,
organization_id,
name,
source_id,
snapshot_id,
owner_id,
created_at,
updated_at
)
SELECT
generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_entity_type),
@tenant_id,
soa.organization_id,
soa.name,
soa.id,
@snapshot_id,
soa.owner_id,
soa.created_at,
soa.updated_at
generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_entity_type),
@tenant_id,
soa.organization_id,
soa.name,
soa.id,
@snapshot_id,
soa.owner_id,
soa.created_at,
soa.updated_at
FROM states_of_applicability soa
WHERE %s
AND soa.organization_id = @organization_id
AND soa.snapshot_id IS NULL
`
WHERE
%s
AND soa.organization_id = @organization_id
AND soa.snapshot_id IS NULL
`
query = fmt.Sprintf(query, scope.SQLFragment())
@@ -399,47 +402,48 @@ func (soas StatesOfApplicability) insertStateOfApplicabilityControlSnapshots(
) error {
query := `
WITH source_soa AS (
SELECT id, organization_id
FROM states_of_applicability
WHERE %s
AND organization_id = @organization_id
AND snapshot_id IS NULL
SELECT id, organization_id
FROM states_of_applicability
WHERE
%s
AND organization_id = @organization_id
AND snapshot_id IS NULL
),
snapshot_soa AS (
SELECT id, source_id
FROM states_of_applicability
WHERE snapshot_id = @snapshot_id
SELECT id, source_id
FROM states_of_applicability
WHERE snapshot_id = @snapshot_id
)
INSERT INTO states_of_applicability_controls (
id,
state_of_applicability_id,
control_id,
organization_id,
tenant_id,
snapshot_id,
applicability,
justification,
created_at,
updated_at
id,
state_of_applicability_id,
control_id,
organization_id,
tenant_id,
snapshot_id,
applicability,
justification,
created_at,
updated_at
)
SELECT
generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_control_entity_type),
snapshot_soa.id,
soac.control_id,
soac.organization_id,
@tenant_id,
@snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at
generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_control_entity_type),
snapshot_soa.id,
soac.control_id,
soac.organization_id,
@tenant_id,
@snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at
FROM states_of_applicability_controls soac
INNER JOIN source_soa
ON soac.state_of_applicability_id = source_soa.id
ON soac.state_of_applicability_id = source_soa.id
INNER JOIN snapshot_soa
ON snapshot_soa.source_id = source_soa.id
ON snapshot_soa.source_id = source_soa.id
WHERE soac.snapshot_id IS NULL
`
`
query = fmt.Sprintf(query, scope.SQLFragment())

142
pkg/coredata/state_of_applicability_control.go
View File

@@ -96,28 +96,29 @@ func (sac *StateOfApplicabilityControl) LoadByStateOfApplicabilityIDAndControlID
) error {
q := `
WITH current_soa AS (
SELECT id
FROM states_of_applicability
WHERE %s
AND id = @state_of_applicability_id
AND snapshot_id IS NULL
SELECT id
FROM states_of_applicability
WHERE
%s
AND id = @state_of_applicability_id
AND snapshot_id IS NULL
)
SELECT
soac.id,
soac.state_of_applicability_id,
soac.control_id,
soac.organization_id,
soac.snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at
soac.id,
soac.state_of_applicability_id,
soac.control_id,
soac.organization_id,
soac.snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at
FROM
states_of_applicability_controls soac
states_of_applicability_controls soac
INNER JOIN
current_soa ON soac.state_of_applicability_id = current_soa.id
current_soa ON soac.state_of_applicability_id = current_soa.id
WHERE
soac.control_id = @control_id
soac.control_id = @control_id
LIMIT 1;
`
q = fmt.Sprintf(q, scope.SQLFragment())
@@ -217,7 +218,8 @@ SET
applicability = @applicability,
justification = @justification,
updated_at = @updated_at
WHERE %s
WHERE
%s
AND state_of_applicability_id = @state_of_applicability_id
AND control_id = @control_id
`
@@ -304,15 +306,16 @@ func (sac *StateOfApplicabilityControl) Delete(
) error {
q := `
WITH current_soa AS (
SELECT id
FROM states_of_applicability
WHERE %s
AND id = @state_of_applicability_id
AND snapshot_id IS NULL
SELECT id
FROM states_of_applicability
WHERE
%s
AND id = @state_of_applicability_id
AND snapshot_id IS NULL
)
DELETE FROM states_of_applicability_controls
WHERE state_of_applicability_id IN (SELECT id FROM current_soa)
AND control_id = @control_id;
AND control_id = @control_id;
`
args := pgx.StrictNamedArgs{
@@ -380,39 +383,41 @@ func (sacs *StateOfApplicabilityControls) LoadByControlID(
) error {
q := `
WITH soac_ctrl AS (
SELECT
soac.id,
soac.state_of_applicability_id,
soac.control_id,
soac.organization_id,
soac.snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at,
soac.tenant_id
FROM
states_of_applicability_controls soac
INNER JOIN
states_of_applicability soa ON soac.state_of_applicability_id = soa.id
WHERE
soac.control_id = @control_id
AND soa.snapshot_id IS NULL
SELECT
soac.id,
soac.state_of_applicability_id,
soac.control_id,
soac.organization_id,
soac.snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at,
soac.tenant_id
FROM
states_of_applicability_controls soac
INNER JOIN
states_of_applicability soa ON soac.state_of_applicability_id = soa.id
WHERE
soac.%[1]s
AND soac.control_id = @control_id
AND soa.snapshot_id IS NULL
)
SELECT
id,
state_of_applicability_id,
control_id,
organization_id,
snapshot_id,
applicability,
justification,
created_at,
updated_at
id,
state_of_applicability_id,
control_id,
organization_id,
snapshot_id,
applicability,
justification,
created_at,
updated_at
FROM
soac_ctrl
WHERE %s
AND %s
soac_ctrl
WHERE
%[1]s
AND %[2]s
`
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
@@ -442,21 +447,25 @@ func (sacs *StateOfApplicabilityControls) CountByControlID(
) (int, error) {
q := `
WITH soac_ctrl AS (
SELECT
soac.id,
soac.organization_id,
soac.tenant_id
FROM
states_of_applicability_controls soac
WHERE
soac.control_id = @control_id
SELECT
soac.id,
soac.organization_id,
soac.tenant_id
FROM
states_of_applicability_controls soac
INNER JOIN
states_of_applicability soa ON soac.state_of_applicability_id = soa.id
WHERE
soac.%[1]s
AND soac.control_id = @control_id
AND soa.snapshot_id IS NULL
)
SELECT
COUNT(id)
COUNT(id)
FROM
soac_ctrl
soac_ctrl
WHERE
%s;
%[1]s;
`
q = fmt.Sprintf(q, scope.SQLFragment())
@@ -499,7 +508,8 @@ filtered_controls AS (
c.tenant_id,
c.best_practice
FROM controls c
WHERE %s
WHERE
%s
),
all_controls AS (
SELECT